op5dev/Terraform/OpenTofu via Pull Request

Plan and apply Terraform/OpenTofu via PR automation, using best practices for secure and scalable IaC workflows.

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jul 9, 2026
License: Apache 2.0

Pinned Snippet

workflow.ymlSHA-pinned

uses: op5dev/tf-via-pr@39ed2635c056ca408ed24cc5c2baf0ef4381a7a5 # v13.7.4

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
command	Command to run between: `plan` or `apply`. Optionally `init` for checks and outputs only (e.g., `plan`).	no	""
comment-method	PR comment by: `update` existing comment or `recreate` and delete previous one (e.g., `update`).	no	update
comment-pos-1	Markdown content to render at various positions in the PR comment (e.g., `Before command`).	no	<!-- comment-pos-1 -->
comment-pos-2	Markdown content to render at various positions in the PR comment (e.g., `Before diff`).	no	<!-- comment-pos-2 -->
comment-pos-3	Markdown content to render at various positions in the PR comment (e.g., `Before summary`).	no	<!-- comment-pos-3 -->
comment-pos-4	Markdown content to render at various positions in the PR comment (e.g., `Before footer`).	no	<!-- comment-pos-4 -->
comment-pos-5	Markdown content to render at various positions in the PR comment (e.g., `Before identifier`).	no	<!-- comment-pos-5 -->
comment-pos-6	Markdown content to render at various positions in the PR comment (e.g., `After identifier`).	no	<!-- comment-pos-6 -->
comment-pr	Add a PR comment: `always`, `on-diff`, or `never` (e.g., `always`).	no	always
expand-diff	Expand the collapsible diff section (e.g., `false`).	no	false
expand-summary	Expand the collapsible summary section (e.g., `false`).	no	false
format	Check format of TF code (e.g., `false`).	no	false
hide-args	Hide comma-separated arguments from the command input (e.g., `detailed-exitcode,lock,out,var=`).	no	detailed-exitcode,parallelism,lock,out,var=
plan-encrypt	Encrypt plan file artifact with the given input (e.g., `secrets.PASSPHRASE`).	no	""
plan-file	Supply existing plan file path instead of the auto-generated one (e.g., `path/to/file.tfplan`).	no	""
plan-parity	Replace the plan file if it matches a newly-generated one to prevent stale apply (e.g., `false`).	no	false
pr-number	Specify PR number in case of unsupported workflow trigger (e.g., `123`).	no	""
preserve-plan	Preserve plan file in the given working directory after workflow execution (e.g., `false`).	no	false
retention-days	Duration after which plan file artifact will expire in days (e.g., '90').	no	""
show-args	Show comma-separated arguments in the command input (e.g., `workspace`).	no	workspace
tag-actor	Tag the workflow triggering actor: `always`, `on-diff`, or `never` (e.g., `always`).	no	always
token	Specify a GitHub token (e.g., `secrets.GITHUB_TOKEN`).	no	${{ github.token }}
tool	Provisioning tool to use between: `terraform` or `tofu` (e.g., `terraform`).	no	terraform
upload-plan	Upload plan file as GitHub workflow artifact (e.g., `true`).	no	true
validate	Check validation of TF code (e.g., `false`).	no	false
working-directory	Specify the working directory of TF code, alias of `arg-chdir` (e.g., `stacks/dev`).	no	""
arg-auto-approve	auto-approve	no	""
arg-backend-config	backend-config	no	""
arg-backend	backend	no	""
arg-backup	backup	no	""
arg-chdir	chdir	no	""
arg-check	check	no	true
arg-compact-warnings	compact-warnings	no	""
arg-concise	concise	no	""
arg-destroy	destroy	no	""
arg-detailed-exitcode	detailed-exitcode	no	true
arg-diff	diff	no	true
arg-force-copy	force-copy	no	""
arg-from-module	from-module	no	""
arg-generate-config-out	generate-config-out	no	""
arg-get	get	no	""
arg-list	list	no	""
arg-lock-timeout	lock-timeout	no	""
arg-lock	lock	no	""
arg-lockfile	lockfile	no	""
arg-migrate-state	migrate-state	no	""
arg-no-tests	no-tests	no	""
arg-parallelism	parallelism	no	""
arg-plugin-dir	plugin-dir	no	""
arg-reconfigure	reconfigure	no	""
arg-recursive	recursive	no	true
arg-refresh-only	refresh-only	no	""
arg-refresh	refresh	no	""
arg-replace	replace	no	""
arg-state-out	state-out	no	""
arg-state	state	no	""
arg-target	target	no	""
arg-test-directory	test-directory	no	""
arg-upgrade	upgrade	no	""
arg-var-file	var-file	no	""
arg-var	var	no	""
arg-workspace	workspace	no	""
arg-write	write	no	""

Outputs

name	description
check-id	ID of the check run.
command	Input of the last TF command.
comment-body	Body of the PR comment.
comment-id	ID of the PR comment.
diff	Diff of changes, if present (truncated).
exitcode	Exit code of the last TF command.
identifier	Unique name of the workflow run and artifact.
job-id	ID of the workflow job.
plan-id	ID of the plan file artifact.
plan-url	URL of the plan file artifact.
result	Result of the last TF command (truncated).
run-url	URL of the workflow run.
summary	Summary of the last TF command.